Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
The working of BPDU filter configured globally is described as follows:
If that port receives a BPDU it loses its Portfast status and transitions through the normal Blocking, Learning, Listening, and Forwarding state, as necessary
What is the purpose of the global BPDU filter? Why doesn't it work the same way as BPDU filter configured on a port?
What is the purpose of the global BPDU filter?
Portfast is a feature that should only be implemented on ports that do not receive BPDUs (or need to send them). In other words, it should only be implemented on edge ports. So if you receive BPDUs on such a port, how do you want to handle it?
Two features give you the ability to respond in any of the three above ways, BPDU filter and BPDU guard.
If you want to do nothing, simply apply BPDU filter at the interface level. The only time I have ever seen this used wisely is when you are handing off to a customer (and have taken other precautions to avoid issues).
Since end users generally should not be allowed to connect their own switches to the network, most places today seem to go with option two, utilizing BPDU guard coupled with err-disable recovery. This will shut down the port automatically if a device sending BPDUs (or one that will loop BPDUs back to the interface) is connected to the network. Interfaces will automatically be re-enabled after a set time and will stay re-enabled if the condition were removed.
Global configuration of BPDU filter is the middle of the road and allows you to apply the command automatically to any port where you have enabled portfast. If BPDUs are detected it will drop the portfast mode. This would allow you to plug in another switch device without losing access or risking a L2 loop. I can't think of many reasons today to use this, although in the past when BPDU guard didn't have an err-disable recovery option (i.e. re-enabling ports was a manual process) it could be a better choice than BPDU guard, protecting the network while not increasing load on IT staff.
Additionally, the interface versions of BPDU filter/guard both supersede the global configuration. In other words, you can use the interface command to disable a globally enabled feature on a portfast enabled interface. Additionally, while the global version only apply to interfaces with portfast enabled, you can enable either on an interface that does not have portfast enabled.
Why doesn't it work the same way as BPDU filter configured on a port?
Because it wasn't designed that way. It was designed to provide additional configuration options to tailor the operation to the needs of your network.
For example, you could have a situation where you wanted a portfast enabled port but did not want to send or receive BPDUs. If both global and interface commands worked the same, you would have issues trying to configure it this way if both acted the same as the global configuration. Conversely, if you wanted the "middle of the road" above but both acted like the interface command, you would have issues.
The different behavior of the two commands is because they serve a different purpose. Both having the same name is confusing though. They could have named the global command something like "edge protect". Portfast ports are spanning-tree edge ports, so only meant to be connected to systems that don't run spanning tree.
The different purpose is also the reason the two work differently in sending BPDUs: configured on the port will send no BPDUs, configured on globally, it will send for ten hello timers (=11 BPDUs, one at the beginning, plus one every hello timer).
